Comparing captures and building timelines

#Plain languageIn plain terms

A lookup is a snapshot at one moment from one set of sources. Look again an hour later, or through a different source, and you may see something different. Forensia lets you keep two snapshots in one investigation and compare them.

It compares only records it can identify exactly as the same event. It reports differences. It does not decide which snapshot is right.

#How it worksHow it works

1. Save a result. It is sealed with a digest so later changes can be detected.
2. Save a second result into the same investigation.
3. Each record gets an identity based on where it occurred on the chain.
4. Records with the same identity in both snapshots are compared field by field.
5. All transactions are placed on a timeline by block.

#Technical detailThe exact rules

An investigation holds at most 2 snapshots. Each is fingerprinted with SHA-256 over its contents written out with keys in sorted order. Saving the same snapshot twice is refused.

What makes two records the same event

Anything without such an identity is left out of the comparison and counted as excluded: internal calls, wallet-level Bitcoin summaries, records with conflicting sources, duplicates, and records whose source references do not each resolve to exactly one captured source record. Records are paired only on the same network. A record that appears in only one snapshot is counted as unpaired and is not compared. Similar addresses, amounts or symbols are never used to pair records.

For a pair, these fields are compared: sender, recipient, execution status, asset contract and token standard. If contract and standard agree, the raw quantity (for an NFT, the token IDs and their raw quantities) and recorded decimals are compared too. A difference is reported only when both sides have a value and the values differ. A missing field is not a contradiction.

If the two snapshots hold more than 1,024 records in total, nothing is compared. A partial comparison could hide a conflict.

Timelines

Records are grouped by transaction and sorted by block, oldest first. Unknown or conflicting positions come last. Each network shows 8 transactions until you choose "Show all saved transactions". Several safeguards apply:

• If a transaction's records report different blocks, its position is withdrawn.
• If its records report different times, or two transactions in one block report different times, the time is withdrawn and shown as "Reported times conflict or are invalid".
• A block-header time captured for a transaction that was itself looked up is used only as a contradiction check. If it differs from a time reported for that block, the time is withdrawn. It never fills in a missing time.
• Transactions sharing a block are put in order only when every one of them has a captured transaction index from the same captured block hash. The position then reads, for example, "Transaction 4 in captured block (index 3)". Otherwise each is marked "Other transactions share this block. Their order is not established here."
• A transaction index is captured only for an Ethereum-style transaction that was itself looked up and whose execution context passed its checks. If two different transactions report the same index in one block, both lose it and read "Transaction position conflicts or could not be validated".
• If two snapshots report different block hashes for one block number, every entry in that block loses its position. No version is chosen.
• Each network gets its own lane. Lanes have no order relative to each other.

Captures of the same subject in one session

Without saving anything, Overview flags up to 3 other captures of the same subject on the same network held in the current session, newest first. For each it counts the distinct transactions one capture retrieved and the other did not, under the heading "Your captures of this address do not match" or "You have captured this address before in this session" ("transaction" replaces "address" for a transaction lookup). The captures are compared, never merged. Each keeps its own evidence.

#LimitsWhat it does not tell you

• Two snapshots through the same provider can agree and both be wrong.
• The two snapshots do not have to be of the same address. Grouping them does not show they are connected.
• A timeline orders blocks. It does not show that one transaction caused another.
• Nothing is added or subtracted between snapshots. No balance change is computed.
• Timelines contain only saved records. Missing history stays missing.